MDKSA-2000:035

Problembeschreibung

A problem exists in the Zope package with the getRoles method of user
objects contained in the default UserFolder implementation. Users with
the ability to edit DTML could arrange to give themselves extra roles
for the duration of a single request by mutating the roles list as a
part of the request process.